lib/unsafe_build_and_create.rb @@ -1,4 +1,4 @@ -# FindMassAssignment +# Find Mass Assignment ## A Rails plugin to find likely mass assignment vulnerabilities @@ -12,7 +12,7 @@ Install this plugin as follows: For more information, see my [brief review of mass assignment](http://blog.insoshi.com/2008/09/21/mass-assignment-in-rails-applications/) and my discussion of [how to fix mass assignment vulnerabilities in Rails](http://blog.insoshi.com/2008/09/21/finding-and-fixing-mass-assignment-problems-in-rails-applications/). -# Example +## Example Suppose line 17 of the Users controller is @@ -27,6 +27,23 @@ but the User model *doesn't* define <tt>attr_accessible</tt>. Then we get the o This indicates that the User model has a likely mass assignment vulnerability. +# Unsafe attribute updates + +It is often useful to override <tt>attr\_accessible</tt>, especially at the console and in tests, so the plugin also adds an assortment of helper methods to Active Record: + +* unsafe\_new +* unsafe\_build +* unsafe\_create/unsafe\_create! +* unsafe\_update\_attributes/unsafe\_update\_attributes! + +These work just like their safe counterparts, except they bypass attr\_accessible. For example, + +<pre> +Person.unsafe_new(:admin => true) +</pre> + +works even if <tt>admin</tt> isn't attr\_accessible. + # Copyright Copyright (c) 2008 Michael Hartl, released under the MIT license README.markdown @@ -1 +1 @@ -# Include hook code here +require File.join(File.dirname(__FILE__), "lib", "unsafe_build_and_create") \ No newline at end of file init.rb f5fcdec6c46f1b4eaaa9d62722f1e0be8eaf2ddf Michael Hartl michael@michaelhartl.com http://github.com/mhartl/find_mass_assignment/commit/146da1c378f5b69e0a2e1b9bb059344896d01b26 146da1c378f5b69e0a2e1b9bb059344896d01b26 2009-04-27T12:50:49-07:00 2009-04-27T12:50:49-07:00 Added unsafe_build_and_create 91aa81e5597b022d16516bbf746929bbe446e9e8 Michael Hartl michael@michaelhartl.com